From 3ccb4c923811806ca49c35a45451fd3d3ee3d90f Mon Sep 17 00:00:00 2001
From: Christoph Fabianek <christoph@ownyourdata.eu>
Date: Fri, 23 Oct 2026 20:53:00 +0200
Subject: [PATCH] Build with dpp-criteria 9655c4c; test DPP-CAR-002 v2 and
 DPP-REG-024

- The image is built with dpp-criteria 9655c4c. DPP-CAR-002 version 2
  gives a warning for a GTIN with the GS1 prefix 952, which GS1 uses for
  demonstrations and examples; DPP-REG-024 checks that the unique product
  identifier is an https URL of at most 2000 characters.
- Integration tests: the prefix 952 gives the warning, other prefixes
  do not (also 952 after the indicator digit 9); DPP-REG-024 passes for
  the reference passport and fails for a DID and for 2001 characters.
- kubernetes/deployment.yaml names the digest of the new image.
---
 kubernetes/deployment.yaml           |  2 +-
 test/integration/validations_test.rb | 23 +++++++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/kubernetes/deployment.yaml b/kubernetes/deployment.yaml
index 444eb9f..1835fa9 100644
--- a/kubernetes/deployment.yaml
+++ b/kubernetes/deployment.yaml
@@ -26,7 +26,7 @@ spec:
             app: dpplint
       containers:
       - name: dpplint
-        image: oydeu/dpplint@sha256:9a967537cfba81b96ad377bff375fa2ccfe63c7d72a97dbbf5cd22f08798a1ce
+        image: oydeu/dpplint@sha256:b2a3830a66ec00ccc36eff0e4fd6f52c74cb7da1cd864ca1ac711a735f27b5a1
         imagePullPolicy: IfNotPresent
         ports:
         - containerPort: 3000
diff --git a/test/integration/validations_test.rb b/test/integration/validations_test.rb
index b4bc5ab..cd0fcd8 100644
--- a/test/integration/validations_test.rb
+++ b/test/integration/validations_test.rb
@@ -38,6 +38,29 @@ def criterion(result, id) = result["criteria"].find { |c| c["id"] == id }
     assert_equal "warning", criterion(result, "DPP-DAT-015")["result"]
   end
 
+  test "GTIN with the GS1 prefix 952 for examples gives a warning on the product identifier scheme" do
+    result = criterion(lint(reference), "DPP-CAR-002")
+    assert_equal "warning", result["result"]
+    assert_equal ["warning"], result["messages"].map { |m| m["severity"] }
+    assert_match(/GS1 prefix 952/, result["messages"].first["message"])
+  end
+
+  test "GTIN with another prefix passes the product identifier scheme without a warning" do
+    passport = reference.merge("uniqueProductIdentifier" => "https://dpp.example.org/01/04012345000016/21/000001")
+    assert_equal "passed", criterion(lint(passport), "DPP-CAR-002")["result"]
+    passport = reference.merge("uniqueProductIdentifier" => "https://dpp.example.org/01/95201234567897/21/000001")
+    assert_equal "passed", criterion(lint(passport), "DPP-CAR-002")["result"], "prefix 520 after the indicator digit 9"
+  end
+
+  test "product identifier in the form the EU DPP registry accepts" do
+    assert_equal "passed", criterion(lint(reference), "DPP-REG-024")["result"]
+    result = criterion(lint(reference.merge("uniqueProductIdentifier" => "did:web:dpp.example.org:product:4711")), "DPP-REG-024")
+    assert_equal "failed", result["result"]
+    assert_match(/2000 characters/, result["messages"].first["message"])
+    long = "https://dpp.example.org/01/04012345000016/21/#{'1' * 2000}"
+    assert_equal "failed", criterion(lint(reference.merge("uniqueProductIdentifier" => long)), "DPP-REG-024")["result"]
+  end
+
   test "optional facility identifier is skipped when absent" do
     assert_equal "skipped", criterion(lint(reference), "DPP-ID-010")["result"]
   end